Documentation
¶
Overview ¶
Package compliance maps Kubesplaining rule IDs to controls in the external compliance and hardening frameworks enterprise auditors expect to see (CIS Kubernetes Benchmark v1.9 and NSA/CISA Kubernetes Hardening Guide v1.2). The table is decorated onto findings after analysis so JSON/CSV/SARIF/HTML consumers can filter or group by framework without each analyzer re-deriving the mapping.
Single source of truth: edit ruleControls below to add or rename a control. The mapping is intentionally hand-maintained — the universe of rules is small enough that an explicit table is more honest than a heuristic, and the entries serve as documentation when a new rule is added (the next maintainer can see how peers are tagged).
Index ¶
- Constants
- func Apply(findings []models.Finding) []models.Finding
- func ControlsFor(ruleID string) []models.FrameworkRef
- func FilterByFramework(findings []models.Finding, frameworks []string) []models.Finding
- func HasFramework(f models.Finding, frameworkSlug string) bool
- func ResolveFramework(value string) string
- type FrameworkInfo
Constants ¶
const ( FrameworkCIS19 = "CIS-1.9" // CIS Kubernetes Benchmark v1.9 FrameworkNSA = "NSA-CISA-1.2" // NSA/CISA Kubernetes Hardening Guide v1.2 )
Framework slugs used in FrameworkRef.Framework. Stable strings — consumers (the --compliance flag, the HTML tab data attribute) match against these.
Variables ¶
This section is empty.
Functions ¶
func Apply ¶
Apply decorates each finding with its framework controls in-place. Findings whose rule has no mapping are left with a nil Frameworks slice. Apply is idempotent — calling it twice re-overwrites the slice with a fresh copy, so a downstream pass that adds/removes findings does not have to undo it.
func ControlsFor ¶
func ControlsFor(ruleID string) []models.FrameworkRef
ControlsFor returns the registered framework controls for a rule ID, or nil when no entry exists. The returned slice MUST be treated as read-only by callers; Apply copies it onto each finding so per-finding mutations are isolated.
func FilterByFramework ¶
FilterByFramework returns a new slice containing only findings tagged with any of the given framework slugs. An empty `frameworks` returns the input unchanged so callers can pass the parsed flag value directly without branching on emptiness. Unknown framework slugs match nothing — the caller is responsible for resolving aliases via ResolveFramework before reaching here.
func HasFramework ¶
HasFramework reports whether a finding carries at least one control for the given framework slug. Used by the --compliance CLI filter to drop findings the operator did not ask about.
func ResolveFramework ¶
ResolveFramework returns the canonical slug for a user-supplied framework filter value, accepting case-insensitive matches against either the slug or a short alias ("cis", "nsa"). Returns "" when the input does not name any registered framework.
Types ¶
type FrameworkInfo ¶
type FrameworkInfo struct {
Slug string
Name string // long human-readable name shown in the report
ShortName string // short label shown in chips, tab counts
URL string // link to the published framework document
}
FrameworkInfo carries display-only metadata for a framework slug; used by the HTML report's Compliance tab to render readable headings and link to the source document.
func Frameworks ¶
func Frameworks() []FrameworkInfo
Frameworks returns the registered frameworks in canonical display order. The slugs returned here are the same strings consumers pass via --compliance.
Source Files